Improper authentication in Apache Shiro
Priority HIGH 84CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 5 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287.
Summary
Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.
Why it matters now
EPSS 0.85911 99th percentileScored 2026-11-07
Fix Partial Apache Shiro: 1.7.1org.apache.shiro:shiro-web (Maven): 1.7.1+2 more productsRed Hat: 5 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Apache Shiro | before 1.7.1 | 1.7.1 | Patch available | CNA |
| — | org.apache.shiro:shiro-web (Maven) | before 1.7.1 | 1.7.1 | Patch available | GHSA-v98j-7crc-wvrj |
| — | org.apache.shiro:shiro-spring (Maven) | before 1.7.1 | 1.7.1 | Patch available | GHSA-v98j-7crc-wvrj |
| — | org.apache.shiro:shiro-spring-boot-starter (Maven) | before 1.7.1 | 1.7.1 | Patch available | GHSA-v98j-7crc-wvrj |
- Apache Shiro Vendor— Affected before 1.7.1 Fixed in 1.7.1 Patch available CNA
- org.apache.shiro:shiro-web (Maven) Vendor— Affected before 1.7.1 Fixed in 1.7.1 Patch available GHSA-v98j-7crc-wvrj
- org.apache.shiro:shiro-spring (Maven) Vendor— Affected before 1.7.1 Fixed in 1.7.1 Patch available GHSA-v98j-7crc-wvrj
- org.apache.shiro:shiro-spring-boot-starter (Maven) Vendor— Affected before 1.7.1 Fixed in 1.7.1 Patch available GHSA-v98j-7crc-wvrj
Remediation
- Fix · CNA Apache Shiro Fixed in 1.7.1
- Fix · GHSA-v98j-7crc-wvrj org.apache.shiro:shiro-web (Maven) Fixed in 1.7.1 Advisory →
- Fix · GHSA-v98j-7crc-wvrj org.apache.shiro:shiro-spring (Maven) Fixed in 1.7.1 Advisory →
- Fix · GHSA-v98j-7crc-wvrj org.apache.shiro:shiro-spring-boot-starter (Maven) Fixed in 1.7.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat JBoss A-MQ 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Will not fix |
Timeline
- 2026-10-02 Threatist record created from CVE-2020-17523
- 2026-10-03 Alias added: GHSA-v98j-7crc-wvrj
References
Advisory 2
Other 17
- [activemq-gitbox] 20210210 [GitHub] [activemq] ehossack-aws opened a new pull request #614: Update shiro to 1.7.1
- [activemq-issues] 20210301 [jira] [Created] (AMQ-8159) High severity security issues found in Apache Shiro v.1.7.0
- [shiro-dev] 20210331 Re: Request for assistance to backport CVE-2020-13933 fix
- [shiro-dev] 20210407 Re: Request for assistance to backport CVE-2020-13933 fix
- [shiro-dev] 20210424 Re: Ask help for upgrading Shiro in CDH platform to 1.7.1
- [activemq-users] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs
- [shiro-dev] 20210504 Re: Request for assistance to backport CVE-2020-13933 fix
- https://github.com/apache/shiro/pull/263
- https://issues.apache.org/jira/browse/SHIRO-797
- https://lists.apache.org/thread.html/r5b93ddf97e2c4cda779d22fab30539bdec454cfa5baec4ad0ffae235@%3Cgitbox.activemq.apache.org%3E
- https://lists.apache.org/thread.html/r679ca97813384bdb1a4c087810ba44d9ad9c7c11583979bb7481d196@%3Cdev.shiro.apache.org%3E
- https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd@%3Cusers.activemq.apache.org%3E
- https://lists.apache.org/thread.html/r852971e28f54cafa7d325bd7033115c67d613b112a2a1076817390ac@%3Cdev.shiro.apache.org%3E
- https://lists.apache.org/thread.html/r9d93dfb5df016b1a71a808486bc8f9fbafebbdbc8533625f91253f1d@%3Cdev.shiro.apache.org%3E
- https://lists.apache.org/thread.html/rd4b613e121438b97e3eb263cac3137caddb1dbd8f648b73a4f1898a6@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/re25b8317b00a50272a7252c4552cf1a81a97984cc2111ef7728e48e0@%3Cdev.shiro.apache.org%3E
- http://shiro.apache.org/download.html
More Apache Shiro vulnerabilities
- TI-2016-03813 Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember… KEVCVSS 3.1CRITICAL 9.8
- TI-2021-18132 Improper authentication in Apache Shiro CVSS 3.1CRITICAL 9.8
- TI-2022-14167 Authentication bypass in Apache Shiro CVSS 3.1CRITICAL 9.8
- TI-2020-09649 Improper authentication in Apache Shiro CVSS 3.1CRITICAL 9.8
- TI-2020-10910 Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass. CVSS 3.1HIGH 7.5
- TI-2020-01881 Improper authentication in Apache Shiro CVSS 3.1CRITICAL 9.8
Sources
- CVE-2020-17523 · CVE Program
- CVE-2020-17523 · NVD
- FIRST EPSS
- GHSA-v98j-7crc-wvrj · GitHub Advisory Database · CC BY 4.0
- CVE-2020-17523 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences